referred bind does not pass proper DN (ITS#3264)

[Kurt@OpenLDAP.org]

2.2 only returns referrals for bind operations if the
bind name is not within a database held by the server.
This behavior is actually incorrect.  An invalidCreditials
should be returned instead (as discussed in RFC 3296).
I have fixed that in HEAD.

Kurt